mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
c3a3518c36
* feat: Show cooldown report for pinned version installs When a user installs a package with an explicit version (e.g. npm install foo@1.2.3) and that version falls within the dependency cooldown window, the cooldown block is now recorded and shown in the report. Previously, the report only appeared when ALL versions of a package were in cooldown (remaining == 0), causing pinned version installs to fail with a confusing "version not found" error from the package manager instead of a clear cooldown explanation. Introduces InterceptorContext to carry per-execution data (pinned versions) from the CLI command through the interceptor layer, keeping it separate from long-lived dependencies like the analyzer and cache. * fix: Normalize PyPI pinned version keys for cooldown lookup CLI-provided package names (e.g. Flask_Cors) don't match the URL-parsed form (flask-cors). Normalize keys once at construction time so cooldown lookups match correctly. * fix: Handle dots in PyPI package name normalization per PEP 503 denormalizePyPIPackageName already documented [-_.] replacement but only handled underscores. Now also replaces dots with hyphens so names like zope.interface match the URL-parsed form zope-interface. * refactor: Extract shared cooldown stats recording into helper Deduplicate identical stats-recording blocks from npm_cooldown.go and pypi_cooldown.go into recordCooldownStats in cooldown.go. * fix: Distinguish explicit version pins from auto-resolved versions PyPI parsers resolve all packages to concrete versions (even without a user-specified constraint), so HasVersion() was always true. Add IsExplicitVersion to PackageInstallTarget, set it only when the user provided an explicit constraint. Use it in proxy_flow.go to avoid false pinned-version cooldown reports.
32 lines
838 B
Go
32 lines
838 B
Go
package interceptors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/safedep/pmg/proxy"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestPypiRegistryInterceptor_ShouldMITM(t *testing.T) {
|
|
interceptor := NewPypiRegistryInterceptor(nil, nil, nil, nil, InterceptorContext{})
|
|
|
|
tests := []struct {
|
|
name string
|
|
hostname string
|
|
wantMITM bool
|
|
}{
|
|
{"pypi files is MITM'd", "files.pythonhosted.org", true},
|
|
{"pypi org is MITM'd", "pypi.org", true},
|
|
{"test pypi is NOT MITM'd", "test.pypi.org", false},
|
|
{"test pypi files is NOT MITM'd", "test-files.pythonhosted.org", false},
|
|
{"unknown registry is NOT MITM'd", "registry.example.com", false},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
ctx := &proxy.RequestContext{Hostname: tt.hostname}
|
|
assert.Equal(t, tt.wantMITM, interceptor.ShouldMITM(ctx))
|
|
})
|
|
}
|
|
}
|